CVE-2018-17783: XSS
Published Oct 30, 2018
·Updated
A cross-site scripting (XSS) vulnerability in the Edit Filter page (managefilteredit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
Affected Software
2 affected componentsFixes available
MantisBT mantisbt>=2.1.0<=2.17.1
composer/mantisbt/mantisbt>=2.1.0<2.17.2
2.17.2
Remediation
Patch Available
Event History
Oct 30, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·01:52 AM
Frequently Asked Questions
1
What is CVE-2018-17783?
CVE-2018-17783 is a cross-site scripting (XSS) vulnerability in MantisBT.
2
How does the vulnerability CVE-2018-17783 affect MantisBT?
The vulnerability allows remote attackers to inject arbitrary code through a crafted project name.
3
What is the severity of CVE-2018-17783?
The severity of the vulnerability is medium with a CVSS score of 5.4.
4
What is the Common Weakness Enumeration (CWE) ID for CVE-2018-17783?
The CWE ID for CVE-2018-17783 is CWE-79.
5
How can I fix the cross-site scripting vulnerability in MantisBT (CVE-2018-17783)?
To fix the vulnerability, update MantisBT to version 2.17.1 or above.